Ecosystem
Packagist
7,192 known vulnerabilities.
Most affected packages
7,182 results · Feed
-
Medium 4.3
Improper Access Control in snipe/snipe-it
snipe-it is vulnerable to Improper Access Control
-
High 7.4
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 5.5
Cross-site Scripting (XSS) - Reflected in pimcore/pimcore
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in pimcore/pimcore
pimcore is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 6.5
Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2
kimai2 is vulnerable to Cross-Site Request Forgery (CSRF)
-
Critical 9.8
DBAL 3 SQL Injection Security Vulnerability
Doctrine DBAL 3.x before 3.1.4 allows SQL Injection. The escaping of offset and length inputs to the generation of a LIMIT clause was not probably cast to an integer, allowing SQL injection to take place if application developers passed unescaped user input t…
-
Unscored —
### Access Bypass: This module enables you to build forms and surveys in Drupal. The module doesn't sufficiently check …
-
Medium 6.1
Cross-site Scripting (XSS) - Stored in livehelperchat/livehelperchat
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 5.3
Blade `@parent` Exploitation Leading To Possible XSS in Laravel
Laravel is a web application framework. Laravel prior to versions 8.75.0, 7.30.6, and 6.20.42 contain a possible cross-site scripting (XSS) vulnerability in the Blade templating engine. A broken HTML element may be clicked and the user taken to another locati…
-
High 7.5CVE-2021-43789 Public exploit
Blind SQLi using Search filters in PrestaShop
PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using search filters with `orderBy` and `sortOrder` parameters. The problem is fixed in version 1.7.8.2.
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
-
Critical 9.8
Deserialization of Untrusted Data in topthink/framework
ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache.
-
Critical 9.8
Deserialization of Untrusted Data in topthink/framework
ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\Adapter.php.
-
Low 2.7
Server-Side Request Forgery (SSRF) in snipe/snipe-it
snipe-it is vulnerable to Server-Side Request Forgery (SSRF)
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 5.3
Exposure of Private Personal Information to an Unauthorized Actor in elgg/elgg
elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
-
Critical 9.8
Path manipulation in matyhtf/framework
matyhtf framework v3.0.5 is affected by a path manipulation vulnerability in Smarty.class.php.
-
Critical 9.8
Path traversal in librenms/librenms
Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php.
-
Medium 6.5
Open Redirect in star7th/showdoc
showdoc is vulnerable to URL Redirection to Untrusted Site
-
Low 3.1
Cross-Site Request Forgery (CSRF) in bookstackapp/bookstack
bookstack is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium —
XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be …
-
Medium —
XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be …
-
Medium 6.1
Cross-site Scripting in LibreNMS
Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/common/alert-log.inc.php.
-
Medium 6.1
Cross-site Scripting in LibreNMS
Librenms 21.11.0 is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/forms/poller-groups.inc.php.
-
Medium 4.3
Authorization Bypass Through User-Controlled Key in elgg/elgg
elgg is vulnerable to Authorization Bypass Through User-Controlled Key
-
Medium 6.3
Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2
kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
High 8.0
Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2
kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 6.5
Open Redirect in star7th/showdoc
showdoc is vulnerable to URL Redirection to Untrusted Site
-
Medium 6.5
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in star7th/showdoc
showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
-
Medium 6.5
Improper Access Control in kevinpapst/kimai2
kimai2 is vulnerable to Improper Access Control
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in star7th/showdoc
showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 4.3
Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
-
High 7.3
Cross-Site Request Forgery (CSRF) in star7th/showdoc
showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
-
Medium 6.3
Cross-site Scripting (XSS) - Stored in snipe/snipe-it
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
-
Medium 6.5
Improper Access Control in bookstackapp/bookstack
bookstack is vulnerable to Improper Access Control
-
Critical 9.8
SQL Injection in rosariosis
An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.
-
High 7.7
Zip Slip Vulnerability in BaserCMS
BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions users with upload privilege may upload crafted zip files capable of path traversal on the host operating system. This is a vulnerability that …
-
Critical 9.1
OS Command Injection Vulnerability and Potential Zip Slip Vulnerability
There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissions to upload files may upload crafted zip files which may execute arbitrary commands on the host operating system. Thi…
-
Critical —
Webcache Poisoning in shopware/platform and shopware/core
### Impact Webcache Poisoning via X-Forwarded-Prefix and sub-request ### Patches We recommend updating to the current version 6.4.6.1. You can get the update to 6.4.6.1 regularly via the Auto-Updater or directly via the download overview. https://www.shopware…
-
Medium 6.5
CSV Injection in Symfony
Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Symfony versions 4.1.0 before 4.4.35 and versions 5.0.0 before 5.3.12 are vulnerable t…